Cybercrime Statistics 2026

Americans reported US$20.877 billion in cybercrime losses to the FBI's Internet Crime Complaint Center (IC3) in 2025, up 26% from US$16.6 billion, across 1,008,597 complaints, according to the FBI's 2025 Internet Crime Report, published in April 2026. It was the first year IC3 losses passed US$20 billion and complaints passed one million. The Federal Trade Commission recorded US$15.9 billion in consumer fraud losses from 3 million reports, and Canadians reported more than C$704 million to the Canadian Anti-Fraud Centre. Fraud, not malware, carries most of the money: cyber-enabled fraud accounted for 85% of IC3 losses.

Four threads run through the 2025 data. Investment fraud was the costliest crime type at US$8.65 billion, US$7.2 billion of it cryptocurrency investment fraud. People aged 60 and over reported US$7.75 billion in losses, up 59%. The IC3's first count of AI-related complaints found 22,364, with US$893 million lost. And ransomware payments fell: Chainalysis traced about US$820 million on-chain, down 8%, while claimed attacks rose 50%. This page is for journalists, analysts, students, insurers and security teams who need each figure with its source.

This post is the Stingrai research team's 2026 reference for cybercrime statistics. It brings together more than 200 figures from 13 primary publishers: the FBI's IC3, the Federal Trade Commission, the Canadian Anti-Fraud Centre, the Communications Security Establishment and its Canadian Centre for Cyber Security, Europol, the UK's National Cyber Security Centre, Office for National Statistics and Department for Science, Innovation and Technology, the Australian Signals Directorate, Verizon, Chainalysis, Sophos and IBM. Lead data is full-year 2025 telemetry, the freshest available; primary publishers have not released full-year 2026 reports as of October 2026. Every stat carries its source, year and methodology window so any claim can be audited inline.

Quick answer. The FBI's IC3 received 1,008,597 cybercrime complaints in 2025 reporting US$20.877 billion in losses, up 26% in a year. Investment fraud (US$8.65 billion), business email compromise (US$3.05 billion) and tech support scams (US$2.13 billion) cost the most, phishing and spoofing was the most reported crime (191,561 complaints), and people aged 60 and over lost US$7.75 billion. Complaints that mentioned cryptocurrency carried US$11.37 billion of the losses and AI-related complaints US$893 million. Every official total is a floor: the Canadian Anti-Fraud Centre estimates that only 5% to 10% of fraud is reported.

TL;DR: key cybercrime statistics

• Cybercrime losses reported to the FBI (2025): US$20.877 billion across 1,008,597 complaints, up 26% from US$16.6 billion in 2024 (FBI IC3, 2025 Internet Crime Report).

• Costliest crime type (2025): investment fraud, US$8.65 billion, about 41% of all reported losses; cryptocurrency investment fraud alone cost US$7.2 billion (FBI IC3, 2025 report).

• Share of losses from cyber-enabled fraud (2025): 85%, or US$17.7 billion across 452,868 complaints (FBI IC3, 2025 report).

• Losses reported by people aged 60 and over (2025): US$7.75 billion, up 59%, an average of US$38,500 per complaint (FBI IC3, 2025 report).

• Losses in complaints that mention cryptocurrency (2025): US$11.37 billion across 181,565 complaints, up 22% (FBI IC3, 2025 report).

• AI-related complaints (2025, first year counted): 22,364, with US$893 million in losses (FBI IC3, 2025 report).

• Business email compromise losses (2025): US$3.05 billion across 24,768 complaints; 86% of reported BEC transactions went by wire transfer or ACH (FBI IC3, 2025 report).

• Phishing and spoofing complaints (2025): 191,561, still the most reported crime type but 36% fewer than in 2023, while reported phishing losses tripled in a year to US$215.8 million (FBI IC3, 2025 report).

• Consumer fraud losses reported to the FTC (2025): US$15.9 billion from 3 million fraud reports (FTC, testimony of 25 March 2026).

• On-chain ransomware payments (2025): about US$820 million, down 8%, while claimed ransomware victims rose 50% (Chainalysis, 2026 Crypto Crime Report).

• Median ransom payment (Sophos survey, 2026 report): US$769,000, down from US$1 million; 48% of organizations whose data was encrypted paid (Sophos, State of Ransomware 2026).

• Fraud losses reported in Canada (2025): more than C$704 million across more than 112,000 reports (Canadian Anti-Fraud Centre, Top 10 frauds in 2025); the CAFC estimates only 5% to 10% of fraud is reported (CAFC, Fraud Trends).

• Breaches with a financial motive (Verizon 2026 DBIR): 88% of the 18,175 breaches analyzed for motive (Verizon, 2026 Data Breach Investigations Report).

Key takeaways

• Fraud, not malware, carries the losses. Cyber-enabled fraud made up 85% of IC3 losses in 2025; ransomware complaints reported US$32.3 million, a figure the FBI calls artificially low.

• Fewer reports, bigger losses. Phishing and spoofing complaints fell 36% from 2023 to 2025 while reported phishing losses rose from US$18.7 million to US$215.8 million (Stingrai calculations).

• Older adults carry the heaviest share. About 37% of IC3 losses came from people aged 60 and over (Stingrai calculation).

• AI is now measurable, and probably undercounted. The IC3 logged 22,364 AI-related complaints, and the FBI says many victims do not realize how far AI may be involved.

• Ransomware victims pay less often, but recovery costs more. Chainalysis puts the share who paid at a potential all-time low of 28% and Verizon found 69% did not pay, yet the average recovery cost in Sophos's survey rose 11% to US$1.7 million.

Methodology

Sources and windows. Thirteen primary publishers, each dated with its data window in the References. Lead data is calendar 2025; Verizon covers 1 November 2024 to 31 October 2025, IBM March 2025 to February 2026, and the government sources their fiscal or survey years. Sources were read on 15 and 16 October 2026.

Rules applied. IC3, FTC and CAFC figures count complaints people chose to file, with losses as reported (and, for the IC3, adjusted by its analysts); they are not incidence rates. Each IC3 complaint has one crime type; the cryptocurrency and AI-related descriptors are tags on top, so their losses sit inside the crime-type totals. Consumer Sentinel includes IC3 data, so FBI and FTC totals are never added. Survey results (Sophos, the ONS and UK breaches surveys, IBM's interviews) are not measurements. Amounts stay in the publisher's currency (C$, A$), and Stingrai calculations use the publisher's own figures.

What was dropped. Contradicted figures: the IC3's two values for crypto-related losses of people aged 60 and over (US$4.35 billion and US$4.43 billion) and IBM's US cost rise (given as both 11% and 13%). Unconfirmed stats were dropped rather than estimated. The FBI press release and the ASD website refused automated requests, so FBI figures come from the report PDF and ASD figures from its pages as archived by the Internet Archive in July and September 2026. The US$10.5 trillion figure is a vendor projection and is labelled as one.

Total cybercrime losses and complaints

US$20.877 billion was reported lost to cybercrime by IC3 complainants in 2025, an average of US$20,699 per complaint, from almost 3,000 complaints a day; the IC3 has logged more than 10 million since May 2000. Complaints rose 17% from 859,532 in 2024 (IC3 2024 report) while losses rose 26%, so the average complaint carried more than in 2024 (US$19,372). Losses have more than doubled since 2022 (US$10.3 billion) and are almost five times the US$4.2 billion of 2020 (Stingrai calculations).

Figure 1: Losses reported to the FBI's Internet Crime Complaint Center by year, 2020 to 2025, in US$ billions: 4.2, 6.9, 10.3, 12.5, 16.6 and 20.877. Source: FBI IC3, 2025 Internet Crime Report, Losses by Year chart, p. 4.

The FTC's Consumer Sentinel network, which includes IC3 data among nearly 180 sources, recorded US$15.9 billion in losses from 3 million fraud reports in 2025, up from more than US$12 billion and 2.6 million reports in 2024, and reported fraud losses have risen nearly 430% since 2020 (FTC testimony, 25 March 2026). Because the datasets overlap, the two totals are never added.

Cybercrime by type: what costs the most and what gets reported

Investment fraud cost IC3 complainants US$8.65 billion in 2025, about 41% of all reported losses (Stingrai calculation) and 32% more than in 2024. Government impersonation losses nearly doubled, and of the ten largest named categories only personal data breach and non-payment or non-delivery fell.

Changes are Stingrai calculations from the IC3's three-year comparison tables.

Figure 2: The ten largest named crime types by 2025 loss, against their 2024 losses, in US$ billions. The IC3's "Other" category (US$0.51 billion in 2025) is not shown. Source: FBI IC3, 2025 Internet Crime Report, Three Year Complaint Loss Comparison, p. 26.

By count, phishing and spoofing led with 191,561 complaints, ahead of extortion (89,129) and investment (72,984). Phishing complaints are down 36% from 298,878 in 2023, yet phishing losses tripled in a year to US$215.8 million. Tech support and government impersonation, which the IC3 groups as call center fraud, produced more than 80,000 complaints and more than US$2.9 billion in losses, and the IC3 logged more than 75,000 sextortion submissions.

Payment methods show where controls belong: 72% of reported transactions in investment fraud were cryptocurrency, 86% in BEC were wire or ACH, and cryptocurrency led in tech support (43%) and government impersonation (40%) (IC3, p. 10). See Business Email Compromise Statistics 2026.

FTC consumer reports agree: imposter scams were the most reported fraud in 2025 (more than 1 million reports, nearly one in three fraud reports, and more than US$3.5 billion lost), investment scams the costliest (more than US$7.9 billion, an average loss above US$10,000), text messages the most reported contact method and social media the costliest (FTC testimony; FTC, June 2026). See Phishing Statistics 2026.

Who cybercrime targets: age and place

People aged 60 and over filed 201,266 IC3 complaints in 2025, up 37%, and reported US$7.75 billion in losses, up 59%: about 37% of all losses (Stingrai calculation), an average of US$38,500 per complaint, with 12,444 losing more than US$100,000 each. They lost US$3.52 billion to investment fraud, and their phishing and spoofing complaints more than doubled, from 23,252 to 48,064.

Complainants need not give an age, so the rows do not add up to the national total.

Figure 3: Losses and complaints reported to the IC3 by age group, 2025. Source: FBI IC3, 2025 Internet Crime Report, IC3 Complaints in 2025, p. 6.

Complainants aged 17 or younger filed 13,168 complaints (US$12,988,892), most often about extortion (5,151); the IC3 referred more than 5,700 submissions involving minors to the National Center for Missing and Exploited Children.

California led with 116,414 complaints and US$3.67 billion in losses, ahead of Texas (97,912; US$1.83 billion), Florida (71,843; US$1.60 billion) and New York (45,255; US$1.23 billion); per resident, the District of Columbia ranked first (448.8 complaints and US$14.0 million per 100,000 residents). Abroad, complaints came from more than 200 countries (almost US$1.6 billion of losses), led by Canada (7,479), India (5,879), Japan (5,764) and the United Kingdom (4,106); fraudulent wires went most often to Hong Kong (1,858 transactions), Mexico (1,782) and Indonesia (1,685).

AI-enabled cybercrime

22,364 IC3 complaints in 2025 referenced artificial intelligence, with US$893 million in adjusted losses, the first year the IC3 captured the AI descriptor (its elder fraud comparison table marks it as not captured in 2023 and 2024).

The FBI expects these figures to be low: investment scams lost more than US$8 billion in all, which it says shows that many victims do not realize how far AI may be involved. It also describes voice spoofing, possibly deepfakes, in job interviews aimed at network access rather than money.

Chainalysis found that crypto scams with on-chain links to AI vendors selling face-swap, deepfake and language-model tools took in US$3.2 million per operation against US$719,000 for others, 4.5 times more, and that impersonation scams grew more than 1,400% in 2025 (Chainalysis, Scams). Canada's RCMP and Competition Bureau warned in March 2026 about AI-generated impersonations of public figures promoting investments (CAFC). See also Deepfake Statistics 2026.

Cryptocurrency and cybercrime

US$11.37 billion, 54% of all 2025 IC3 losses, came from complaints that mentioned cryptocurrency (Stingrai calculation): 181,565 complaints, up 21%, with losses up 22%; 18,589 complainants lost more than US$100,000 each, and the average loss was US$62,604.

Recovery scam losses may include the earlier scam that led victims to a fake recovery firm, and people aged 60 and over filed 6,188 kiosk complaints (US$257.5 million). The FBI says crypto investment scams are largely run from Southeast Asia by organized crime using trafficked forced labor; its Operation Level Up notified 3,780 victims in 2025, 78% of whom did not know they were being scammed.

Chainalysis estimates that illicit crypto addresses received at least US$154 billion in 2025, up 162%, mainly because funds received by sanctioned entities rose 694% (Chainalysis, 2026 Crypto Crime Report). Crypto scams took in at least US$14 billion on-chain (Chainalysis projects the figure could exceed US$17 billion as its estimates are revised), and North Korea-linked hackers stole US$2 billion, including nearly US$1.5 billion from Bybit, which the FBI attributed to North Korea on 26 February 2025. See Crypto Hacking Statistics 2026.

Ransomware and extortion

About US$820 million in ransomware payments moved on-chain in 2025, 8% less than the revised US$892 million of 2024, even as claimed victims rose 50% (Chainalysis), and Chainalysis expects the total to approach or exceed US$900 million. The median payment rose 368%, from US$12,738 to US$59,556.

The medians differ by an order of magnitude because the populations differ (attributed on-chain payments, partner loss records and surveyed organizations of 100 to 5,000 employees), so compare each figure only with its own baseline.

The IC3 identified 63 new ransomware variants in 2025; its ten most reported (Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, Ransomhub, Lockbit, Dragonforce, SAFEPAY and Medusa) accounted for 56.8% of incidents. Europol counted more than 120 active ransomware brands in 2025 and names Qilin as dominant (IOCTA 2026).

Email is now the most common way in: in Sophos's survey, malicious email (26%) and phishing (24%) led the root causes, ahead of compromised credentials (23%) and exploited vulnerabilities (18%, down from 32%), and 79% of attacks began with an identity-based approach (Sophos, State of Ransomware 2026). In IBM's Cost of a Data Breach Report 2026, 39% of breached organizations were hit by ransomware (24% in 2023) and 41% of those attacks threatened brand reputation; IBM's average breach cost was a record USD 4.99 million globally and USD 11.5 million in the US, from a nonstatistical sample of 602 organizations, so treat it as context. See Data Breach Statistics 2026.

Which sectors report ransomware to the FBI

Healthcare and public health filed the most ransomware complaints of any critical infrastructure sector in 2025 (460), ahead of critical manufacturing (355), financial services (258), government facilities (233) and information technology (232), which filed the most data breach complaints (199).

Figure 4: Ransomware and data breach complaints to the IC3 from critical infrastructure organizations, 2025, for the 12 sectors with the most ransomware complaints. Source: FBI IC3, 2025 Internet Crime Report, Cyber Threats to Critical Infrastructure, p. 16.

Outside critical infrastructure, more than 1,400 ransomware complaints came mainly from legal services (18%), contracting (17%) and engineering and architecture (10%). See Ransomware Payout Statistics 2026.

Canada and international comparisons

More than C$704 million in fraud losses were reported to the Canadian Anti-Fraud Centre (CAFC) in 2025 from more than 112,000 reports, up from more than C$638 million and 108,878 reports in 2024 (CAFC, Top 10 frauds in 2025; 2024 figures). Investment fraud took C$351 million, about half (Stingrai calculation); spear phishing, which often impersonates executives or suppliers to redirect payments, cost C$67.9 million across 571 victims; and identity fraud was the most reported (8,403 reports).

Figure 5: The Canadian Anti-Fraud Centre's top 10 frauds by reported loss in 2025, in Canadian dollars. Source: Canadian Anti-Fraud Centre, Top 10 frauds in 2025.

Several fraud types are running ahead in 2026. Of approximately C$351 million reported in the first six months, spear phishing accounted for approximately C$57.7 million, already about 85% of its 2025 total (Stingrai calculation), and extortion's approximately C$25.5 million passed the C$23 million reported for all of 2025 (CAFC, Fraud Trends, August 2026).

The Canadian Centre for Cyber Security judges fraud and scams almost certainly the most common cybercrime affecting Canadians, and ransomware the top cybercrime threat to critical infrastructure (National Cyber Threat Assessment 2025-2026). Ransomware incidents known to it grew 26% a year on average from 2021 to 2024, with Akira, Play and Medusa the top three in 2024 (Ransomware Threat Outlook 2025-2027), and it responded to 3,216 incidents in fiscal 2025-26, 1,688 at Canadian entities rather than the Government of Canada (CSE Annual Report 2025-2026). See Cyber Attacks in Canada: Statistics for 2026.

In England and Wales, the change in fraud incidents is not statistically significant, but victims rose 10% and bank and credit account fraud 15% (ONS), and police-recorded fraud data was paused as Report Fraud replaced Action Fraud on 4 December 2025. The other UK rows come from the Cyber Security Breaches Survey 2025/2026 and the NCSC, whose nationally significant incidents rose from 89. In Australia, the ASD put the average self-reported cost per report at A$33,000 for individuals and A$202,700 for large businesses, up 219%.

Under-reporting: why every total is a floor

5% to 10% is the share of fraud the Canadian Anti-Fraud Centre estimates is ever reported (CAFC, August 2026), so the C$704 million reported for 2025 is a fraction of the real loss. The other publishers say the same of their own data:

• FBI. Its ransomware loss figure creates "an artificially low overall ransomware loss rate": it normally excludes lost business, time, wages, files, equipment and remediation, and some victims report no loss.

• FTC. Reported losses are "just a fraction" of actual losses; allowing for underreporting, the FTC estimates fraud could have cost US consumers up to US$195.9 billion in 2024, and research it cites found only 4.8% of mass-market fraud victims complained to a Better Business Bureau or government agency.

• UK NCSC. Many businesses need not report breaches, so its data is "not a true reflection" of UK incidents (NCSC Annual Review 2025).

• Canadian Centre for Cyber Security. Canadian ransomware incidents and payments are almost certainly higher than its figures.

• Verizon. A median of about 9% of the victims each ransomware group publicized had paid, which suggests some leak-site entries may be fabricated.

Household surveys count crimes whether or not anyone reported them, and the ONS names its crime survey, not police records, as its preferred source for fraud.

Projections are not measurements

US$10.5 trillion, the most quoted cybercrime number, is Cybersecurity Ventures' projection for 2025 (US$12.2 trillion by 2031) on a broad cost definition that includes lost productivity and reputational harm. Quote it as a vendor projection, not a measurement.

What this means for defenders

• Verify payment changes out of band. Most reported BEC transactions moved by wire or ACH; after a bad transfer, call the bank and file at ic3.gov at once, since the IC3's Recovery Asset Team froze US$679 million of the US$1.16 billion it acted on (58%).

• Test the people attackers call and email. Measure reporting and help desk responses in phishing and vishing exercises, not only clicks; call center fraud alone cost more than US$2.9 billion.

• Treat MFA as necessary, not sufficient. MFA was in place in 97% of the Sophos incidents rooted in compromised credentials, so test help desk resets, session theft and MFA fatigue paths.

• Patch and test what faces the internet. Exploited vulnerabilities started 18% of ransomware attacks in Sophos's survey, and exposed applications and systems were the top entry point (38%).

• Rehearse recovery and know where to report. Recovery averaged US$1.7 million before any ransom; the FBI's first ransomware recommendation is off-site or offline, encrypted, immutable backups. Report to ic3.gov (United States), local police and the Report Cybercrime and Fraud system (Canada), Report Fraud (England and Wales) or ReportCyber (Australia).

Where Stingrai fits. Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. For these fraud patterns, its social engineering testing runs phishing campaigns with credential capture and MFA-bypass scenarios, vishing and physical security assessments, and its red teaming tests the identity, help desk and remote access paths ransomware crews use. Engagements are human-led by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team. Every confirmed finding is posted to the PTaaS platform the same day it is confirmed, retesting of remediated findings is included, and every human-led and hybrid report ships with an attestation letter, delivered as a one-time annual test or a continuous program.

How to cite this page

Stingrai Research Team. "Cybercrime Statistics 2026." Stingrai, 16 October 2026. https://www.stingrai.io/blog/cybercrime-statistics-2026

Cite single figures to their primary source; cite the percentages marked as Stingrai calculations to this page with the date 16 October 2026.

This compilation is licensed under CC BY 4.0.

Frequently Asked Questions

What are the most important cybercrime statistics in 2026?

Americans reported US$20.877 billion in cybercrime losses to the FBI's Internet Crime Complaint Center in 2025, up 26%, across 1,008,597 complaints. Investment fraud (US$8.65 billion), business email compromise (US$3.05 billion) and tech support scams (US$2.13 billion) cost the most, and people aged 60 and over lost US$7.75 billion.

What is the most common type of cybercrime?

Phishing and spoofing, with 191,561 IC3 complaints in 2025, ahead of extortion (89,129) and investment fraud (72,984). The FTC's most reported fraud was imposter scams (more than 1 million reports), and Canada's was identity fraud (8,403 reports).

Which type of cybercrime causes the biggest losses?

Investment fraud: US$8.65 billion reported to the IC3 in 2025, about 41% of all losses, US$7.2 billion of it cryptocurrency investment fraud. The FTC (more than US$7.9 billion) and the Canadian Anti-Fraud Centre (C$351 million) also rank it first.

Who loses the most money to cybercrime?

People aged 60 and over: US$7.75 billion reported to the IC3 in 2025, up 59%, an average of US$38,500 per complaint against US$20,699 overall, and 12,444 of them each lost more than US$100,000.

How much did ransomware cost in 2025?

Chainalysis traced about US$820 million in on-chain ransomware payments in 2025, down 8%. In Sophos's 2026 survey, the median payment was US$769,000 and the average recovery cost, excluding any ransom, was US$1.7 million.

How are criminals using AI in cybercrime?

The IC3 counted 22,364 AI-related complaints in 2025 with US$893 million in losses, mostly investment scams with a reported AI nexus (more than US$632 million), then AI-assisted business email compromise (more than US$30 million), romance scams (more than US$19 million) and voice-cloning distress scams (more than US$5 million).

Is cybercrime really a US$10.5 trillion problem?

Not by any measured total. US$10.5 trillion is Cybersecurity Ventures' projection of the global cost of cybercrime in 2025, on a broad definition that includes lost productivity, intellectual property theft and reputational harm. Reported losses are far smaller: US$20.877 billion to the FBI's IC3 for 2025.

How much cybercrime goes unreported?

Most of it. The Canadian Anti-Fraud Centre estimates only 5% to 10% of fraud is reported, and the FTC estimates fraud may have cost US consumers up to US$195.9 billion in 2024 once underreporting is counted.

Related reading

• Business Email Compromise Statistics 2026

• Ransomware Payout Statistics 2026

• Phishing Statistics 2026

• Cyber Attacks in Canada: Statistics for 2026

• Crypto Hacking Statistics 2026

• Deepfake Statistics 2026

• OT and ICS Cyberattack Statistics (2026)

References

1. FBI Internet Crime Complaint Center. 2025 Internet Crime Report. April 2026. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf. Complaints filed in calendar 2025.

2. FBI Internet Crime Complaint Center. 2024 Internet Crime Report. 2025. https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf. Totals for 2024.

3. Federal Trade Commission. Prepared Statement on The Rising Scam Economy, Joint Economic Committee. 25 March 2026. https://search.ftc.gov/system/files/ftc_gov/pdf/ftc-testimony-jec-hearing-on-the-rising-scam-economy.pdf. Consumer Sentinel reports for 2025 and the underreporting estimate.

4. Federal Trade Commission. FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025. 15 June 2026. https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025. Consumer Sentinel data for 2025.

5. Canadian Anti-Fraud Centre. Top 10 frauds in 2025. February 2026. https://antifraudcentre-centreantifraude.ca/features-vedette/2026/02/top-fraud-2025-fraudes-plus-courantes-eng.htm. 2025 reports, victims and losses.

6. Canadian Anti-Fraud Centre. Fraud Trends: First 6 Months of 2026. August 2026. https://antifraudcentre-centreantifraude.ca/features-vedette/2026/08/fraud-trends-tendances-matiere-fraude-eng.htm. First-half 2026 losses and the reporting-rate estimate.

7. Canadian Anti-Fraud Centre. Fraud Prevention Month 2025 and Fraud Prevention Month 2026. 2025 and 2026. https://antifraudcentre-centreantifraude.ca/features-vedette/2025/02/month-prevention-mois-eng.htm and https://antifraudcentre-centreantifraude.ca/features-vedette/2026/02/month-prevention-mois-eng.htm. 2024 totals and the AI impersonation warning.

8. Canadian Centre for Cyber Security. National Cyber Threat Assessment 2025-2026. October 2024. https://www.cyber.gc.ca/en/guidance/national-cyber-threat-assessment-2025-2026. Information to 20 September 2024.

9. Canadian Centre for Cyber Security. Ransomware Threat Outlook 2025-2027. October 2025. https://www.cyber.gc.ca/en/guidance/ransomware-threat-outlook-2025-2027. Information to 4 September 2025.

10. Communications Security Establishment Canada. Annual Report 2025-2026. 2026. https://www.cse-cst.gc.ca/en/accountability/transparency/reports/communications-security-establishment-canada-annual-report-2025-2026. Incidents in fiscal 2025-26.

11. Europol. Internet Organised Crime Threat Assessment (IOCTA) 2026. May 2026. https://www.europol.europa.eu/cms/sites/default/files/documents/IOCTA-2026.pdf. EU cybercrime in 2025.

12. UK National Cyber Security Centre. NCSC Annual Review 2025. 14 October 2025. https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly and https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk/incident-management. Incidents handled from 1 September 2024 to 31 August 2025.

13. Office for National Statistics. Crime in England and Wales: year ending March 2026. 23 July 2026. https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingmarch2026. Crime survey estimates.

14. Department for Science, Innovation and Technology and Home Office. Cyber Security Breaches Survey 2025/2026. 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026. Survey of 2,112 businesses and 1,085 charities, August to December 2025.

15. Australian Signals Directorate. Annual Cyber Threat Report 2024-25. 14 October 2025. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025. FY2024-25 reports and incidents.

16. Verizon. 2026 Data Breach Investigations Report. May 2026. https://www.verizon.com/business/resources/T6a9/reports/2026-dbir-data-breach-investigations-report.pdf. More than 22,000 confirmed breaches, 1 November 2024 to 31 October 2025.

17. Chainalysis. 2026 Crypto Crime Report (Introduction, Scams and Ransomware chapters). 8 January, 13 January and 26 February 2026. https://www.chainalysis.com/blog/2026-crypto-crime-report-introduction/, https://www.chainalysis.com/blog/crypto-scams-2026/ and https://www.chainalysis.com/blog/crypto-ransomware-2026/. On-chain data for 2025.

18. Sophos. The State of Ransomware 2026. 2026. https://www.sophos.com/en-us/content/state-of-ransomware and https://assets.sophos.com/X24WTUEQ/at/jbww7pmb8n3gp99wr6hfq4/sophos-state-ransomware-report-2026.pdf. Survey of 2,158 IT and security leaders in 17 countries, January to March 2026.

19. IBM. Cost of a Data Breach Report 2026. 29 July 2026. https://www.ibm.com/reports/data-breach, https://www.ibm.com/downloads/documents/us-en/16dd90a741c46c2c and https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average. Ponemon study of 602 organizations breached from March 2025 to February 2026.

20. Cybersecurity Ventures. 2025 Official Cybercrime Report. 28 May 2025. https://cybersecurityventures.com/official-cybercrime-report-2025/. Vendor projection, not a measured total.

Talk to Stingrai

Fraud, BEC and ransomware reach organizations through people, identity systems and internet-facing applications. Stingrai's penetration testers can scope a phishing and vishing campaign, a red team engagement, or a one-time or continuous penetration test of those systems. Get a quote or book a free discovery call.